Executive Summary

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan disguise their traffic as email services and legitimate processes to evade detection. Threat actors name malware after real OS components or processes to hide their activity.

---

Intelligence Metadata - Source Publisher: The Hacker News - Published Date: 2026-10-06T18:24:25+00:00 - Category: threat-intel

Original Description: Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the name of a real binary, it may

"I have always thought the actions of men the best interpreters of their thoughts."

— John Locke